CIM: is it a problem if own events do not include ALL CIM fields or include MORE than the pre-defined CIM fields?

[DrFedtke]

hi,

we would like to create events in the CIM format, such as for authentication.
before starting we would like to clarify the impact to other application
(using such events for any analyses) if our events

• will not include ALL fields of the CIM standard model
• will include also other fields that are not part of the CIM standard

is there any CIM data health checker?

best
stephen

[hardikJsheth]

To answer your questions

• It's not mandatory that event should contain all the fields as defined in data model.
• It can have additional fields.

The event will be categorised particular data model if it meets the base criteria. i.e For authentication all the events matching following SPL will be part of authentication data model.

tag=authentication

[HiroshiSatoh]

How's this?

SA-cim_validator
https://splunkbase.splunk.com/app/2968/